Another topic that I’ve seen resurface in the forums I frequent is reading remote registries. If you know exactly what you’re looking for it doesn’t get any easier than using REG.EXE from the command line. Here are some examples from the command’s help:<\/p>\n
Examples:<\/p>\n
REG QUERY HKLM\\Software\\Microsoft\\ResKit \/v Version
\nDisplays the value of the registry value Version<\/p>\n
REG QUERY \\ABC\\HKLM\\Software\\Microsoft\\ResKit\\Nt\\Setup \/s
\nDisplays all subkeys and values under the registry key Setup
\non remote machine ABC<\/p>\n
REG QUERY HKLM\\Software\\Microsoft\\ResKit\\Nt\\Setup \/se #
\nDisplays all the subkeys and values with “#” as the seperator
\nfor all valuenames whose type is REG_MULTI_SZ.<\/p>\n
REG QUERY HKLM \/f SYSTEM \/t REG_SZ \/c \/e
\nDisplays Key, Value and Data with case sensitive and exact
\noccurrences of “SYSTEM” under HKLM root for the data type REG_SZ<\/p>\n
REG QUERY HKCU \/f 0F \/d \/t REG_BINARY
\nDisplays Key, Value and Data for the occurrences of “0F” in data
\nunder HKCU root for the data type REG_BINARY<\/p>\n
REG QUERY HKLM\\SOFTWARE \/ve
\nDisplays Value and Data for the empty value (Default)
\nunder HKLM\\SOFTWARE<\/p>\n
To see the complete help open a command prompt and type REG query \/? or REG \/? to see all the things this tool can accomplish.<\/p>\n
I put together a batch file to streamline the query process. It is also attached as a text file.<\/p>\n
@echo off ::**********NOTES********** REM If you don’t specify a name, the script will query REM If you want to save results run REM To process a list of computers use an expression like this: REM If you don’t specify a computer, the local computer will ::**********CONFIGURATION********** set regPath=hklm\\software\\microsoft\\windows NT\\currentversion <\/font><\/p>\n REM Enter the registry key that you want the value of: ::**********MAIN SCRIPT********** REM uncomment next line for debugging FOR \/F “tokens=*” %%a in (‘Reg Query “\\%computer%\\%regpath%” \/v %regkey% ^| <\/font><\/p>\n find \/i “%regkey%”’) do @echo %computer% %%a <\/font><\/p>\n GOTO :OUT <\/font><\/p>\n :OUT :EOF<\/font><\/p>\n The script takes a computer name as a run time parameter. If you don’t specify one then the local computer will be queried.<\/p>\n The script is intended to return the value of a single registry key. There are two variables you need to edit in the script before running it. Of course, you may prefer to modify this script so you can pass keys and values as additional run time parameters.<\/p>\n To query a single computer, open a command prompt in your script directory and run something like this:<\/p>\n C:\\Scripts>regquery jdhit-dc01 As written you’ll need to use traditional console redirection to save the results:<\/p>\n C:\\Scripts>regquery jdhit-dc01 <\/font>> owner.txt<\/p>\n What about a bunch of computers? Easy. Use the FOR command like this:<\/p>\n c:\\Scripts\\for \/f %s in (servers.txt) do @regquery.bat %s >> owners.txt<\/font><\/p>\n If owners.txt already exists all output will be appended to it so you might need to delete first if it exists.<\/p>\n There’s no provision for alternate credentials using REG, so you’ll likely need admin rights for the remote computer you are querying.<\/p>\n If you have simple needs, a simple tool like REG will do the trick. Next time we’ll revisit this topic with VBScript and WMI.<\/p>\n Another topic that I’ve seen resurface in the forums I frequent is reading remote registries. If you know exactly what you’re looking for it doesn’t get any easier than using REG.EXE from the command line. Here’s how to use it and a batch file ready for you to use.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[18],"tags":[32,55,33,56,34,31],"class_list":["post-256","post","type-post","status-publish","format-standard","hentry","category-batchcmd","tag-batch","tag-cli","tag-cmd","tag-command-line","tag-regexe","tag-registry"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/256","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=256"}],"version-history":[{"count":0,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/256\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=256"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=256"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=256"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nREM ReqQuery.bat
\nREM Keywords: Registry,REG,REMote
\nREM USAGE
\nREM RegQuery.bat [computername] <\/font><\/p>\n
\nREM This script will the registry for the specified key.
\nREM The computer name and registry key value will be displayed.
\nREM You can specify a computername as a runtime parameter. <\/font><\/p>\n
\nREM the local machine. <\/font><\/p>\n
\nREM RegQueryList.bat > results.txt <\/font><\/p>\n
\nREM for \/f %s in (servers.txt) do @regquery.bat %s >> results.txt <\/font><\/p>\n
\nREM be queried. <\/font><\/p>\n
\nREM Define the registry path to query. Do not use quotes.
\nREM Remote computers can query either HKLM or HKCU, although as
\nREM a practical matter you can really only use HKLM <\/font><\/p>\n
\nset regKey=RegisteredOwner <\/font><\/p>\n
\nif %1$==$ (
\nset computer=%computername%
\n) else (
\nset computer=%1
\n) <\/font><\/p>\n
\nREM echo Reg Query “\\%computer%\\%regpath%” \/v %regkey% <\/font><\/p>\n
\nset regPath=
\nset regKey=
\nset computer= <\/font><\/p>\n
\njdhit-dc01 RegisteredOwner REG_SZ Jeffery D. Hicks<\/font><\/p>\n